PT-2025-7796 · Go Jose+5 · Go-Jose+5
Mcpherrin
·
Publicado
2025-02-24
·
Atualizado
2026-02-20
·
CVE-2025-27144
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Go JOSE versions 4.0.0 through 4.0.4
Description
The issue is related to excessive memory consumption when parsing compact JWS or JWE input. The code uses strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of
. characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service.Recommendations
For versions 4.0.0 through 4.0.4, update to version 4.0.5 to fix the issue.
As a temporary workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of
. characters.Exploit
Correção
DoS
Resource Exhaustion
Allocation of Resources Without Limits
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Almalinux
Go-Jose
Red Hat
Red Os
Rocky Linux
Suse